fix(android): use stable release keystore for signed APK builds

[Copilot]

Summary

Release APKs were signed with the CI runner's auto-generated debug keystore, which is ephemeral and different on every run. This caused Android to reject upgrades between releases (e.g. 1.1.4 → 1.1.5) due to signature mismatch, requiring users to uninstall the app before installing a newer version.

Changes

android/app/build.gradle.kts

• Reads KEYSTORE_PATH, ANDROID_STORE_PASSWORD, ANDROID_KEY_ALIAS, and ANDROID_KEY_PASSWORD from environment variables to create a release signing config.
• Falls back to the debug signing config when KEYSTORE_PATH is not set, so local development is unaffected.

.github/workflows/release.yml

• Added a Decode release keystore step that base64-decodes the ANDROID_KEYSTORE_BASE64 secret into a temp file before building.
• Passes all four signing env vars to the Package APK step.

Required repository secrets

Please add the following secrets under Settings → Secrets and variables → Actions:

Secret	How to get it
ANDROID_KEYSTORE_BASE64	base64 classi-release.jks (one-liner on Linux/macOS)
ANDROID_KEY_ALIAS	The alias you chose when creating the keystore
ANDROID_STORE_PASSWORD	The keystore password
ANDROID_KEY_PASSWORD	The key password

Important: Keep a secure offline backup of classi-release.jks and its passwords. If lost, you cannot publish updates to the same app ID.